19

How to force GDB to disassemble code when it says "No function contains program counter for selected frame"?

Debugging a program, starting at the absolute address 0x00402200, I get the following output when trying to disassemble the code at this address:

[New Thread 65212.0x10378]

Breakpoint 1, 0x00402200 in ?? ()
(gdb) stepi
0x00402202 in ?? ()
(gdb) stepi
0x00402207 in ?? ()
(gdb) stepi
0x0040220a in ?? ()
(gdb) stepi
0x0040220f in ?? ()
(gdb) disassemble
No function contains program counter for selected frame.
(gdb) stepi
0x00401000 in start ()

The file being debugged is a Win32 PE for educational purposes (reverse engineering).

Is there some way of telling GDB to start disassembling at the address? Otherwise, what are my alternatives (i.e. other tools)?

2
  • 4
    disassemble 0x402202, +20?
    – EOF
    Aug 18, 2016 at 10:53
  • 1
    layout asm / layout reg is nice. Aug 18, 2016 at 18:07

2 Answers 2

22

The documentation of disassemble: (gdb) help disassemble says that:

Disassemble a specified section of memory.
Default is the function surrounding the pc of the selected frame.
...
With a single argument, the function surrounding that address is dumped.
Two arguments (separated by a comma) are taken as a range of memory to dump,
  in the form of "start,end", or "start,+length".

So, in your case, since their is no function surrounding the program counter (PE), you should use the two-argument form, like:

disassemble 0x00402200, +16 or disassemble 0x00402200, 0x00402210.

Hope this helps!

1
  • Thank you, this was just what I needed.
    – Shuzheng
    Aug 18, 2016 at 11:17
10

I know this doesn't directly answers your question, but since it's been already answered...

You can tell GDB to display next instruction with set disassemble-next-line on.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.